Jury 0.0.1 — experimental Linux prerelease

Jury 0.0.1 is an experimental, externally unreviewed pre-alpha release. It does not protect secrets and must not be used with real secrets or private production data. Use synthetic fixtures only.

This prerelease contains the native Linux x86_64 jury CLI and self-hosted juryd witness/anchor daemon. Debian 12 with glibc 2.36 is the tested runtime baseline. The supported scope includes direct and witnessed access, approvals and receipts, backup/restore, authenticated rollover, and suite migration. No macOS, Windows, ARM, TUI, or managed service artifact is included.

Source commit: c4edd6221389e4c63774bfacf66ccbee35c9c54c.

The attached files include the native package, source and vendor archives, two CycloneDX SBOMs, application and SBOM-tool dependency audit reports, build provenance, checksums, and a Sigstore signature bundle. The provenance records the unsigned/unpublished state at build time; the separate signature authenticates its checksum entry along with the other artifacts. These checks do not constitute independent security review.

Before extracting or executing downloaded files, verify the manifest with Cosign and then check every artifact:

cosign verify-blob SHA256SUMS \
  --bundle SHA256SUMS.sigstore.json \
  --certificate-identity '96315340+featherenvy@users.noreply.github.com' \
  --certificate-oidc-issuer 'https://github.com/login/oauth'
sha256sum --check SHA256SUMS

The expected identity and issuer are also documented in the source release instructions. Keep all downloaded artifacts together when checking the manifest.

After verification:

tar -xzf jury-0.0.1-x86_64-unknown-linux-gnu.tar.gz
cd jury-0.0.1-x86_64-unknown-linux-gnu
install -Dm755 jury ~/.local/bin/jury
install -Dm755 juryd ~/.local/bin/juryd
export PATH="$HOME/.local/bin:$PATH"
jury --help
juryd --help

Read the included security policy, release instructions and witness operator walkthrough before exercising the CLI or running services. Earlier experimental format copies may require recreating synthetic vaults and identities as described in those documents.

Report suspected vulnerabilities through GitHub private vulnerability reporting. Include a minimal synthetic reproduction and omit credentials and private data. Public issues are appropriate for non-sensitive bugs only.